HIPAA Security Templates

The HIPAA Security Rule requires covered entities and business associates to conduct regular risk analyses of their electronic Protected Health Information (ePHI) environment. This HIPAA Security Assessment template provides a comprehensive evaluation framework covering all three Security Rule categories: Administrative Safeguards, Physical Safeguards, and Technical Safeguards. The assessment questionnaire walks through each required and addressable specification with clear questions, evidence requirements, and a gap-to-risk mapping.

The template includes a threat identification matrix to document relevant threat sources and vulnerabilities, a risk mitigation planning section for each identified gap, and a risk assessment summary suitable for inclusion in your HIPAA security documentation package. The completed assessment serves as evidence of the Security Rule's risk analysis requirement (§164.308(a)(1)) — the most commonly cited deficiency in HHS Office for Civil Rights investigations. Pair this with the [IT Security Assessment Checklist](/templates/it-security-assessment-checklist) for a broader technical security evaluation.